Business Continuity Plan: Facing Disruption and its Emerging Risks

Anticipation as a basic principle of business continuity planning

We were all enjoying a typical Sunday when the government suddenly launched “social distancing” protocols and quarantines. To many people’s surprise, it included an abrupt halt to all social and commercial activity.

This new reality led all of us to the same question: “What now?” Some institutions had a short section in their business continuity plans dedicated to guaranteeing uninterrupted services in a pandemic scenario. Other companies maybe had an appendix dedicated to comply with a particularly applicable law, rule, or regulation. Most organizations, however, did not consider a pandemic as a real, plausible scenario.

Coronavirus was paralyzing the entire planet, and no one could foresee the challenges, concerns, and opportunities that its effects would bring about in the upcoming weeks or months. Likewise, no one could have predicted that these changes would transform the very nature of the global workforce, the economy, and therefore, everyone’s lifestyles.

When we look closely at business continuity planning methodologies, all of them correctly identify the most important asset:  the workforce. Thus, COVID-19 represented an imminent attack on every organization’s most prized resource.

While some entities had previously adopted a remote work model, others merely contemplated doing so. Yet, in all cases, it seems that the biggest challenges of this quarantine have gyrated around how to overcome limited human interaction between peers, reduced direct supervision over employees, and the availability of physical resources, such as documents.

Why is it important to have a business continuity plan?

History has taught us that organizations without a comprehensive business continuity plan to address every possible scenario are doomed to struggle against large-scale catastrophes. COVID-19 is not the exception.

A well-developed, tested and frequently updated business continuity plan has become an essential ingredient to every organization’s success. Therefore, every business continuity plan should begin with a risk assessment process aimed at identifying potential risks, the probability of said risks, and the impact each risk could have on the business, should it occur.

Historically, there have been several high-impact pandemic events that have taken millions of lives. None, however, happened in the modern era. As a result, until now, many organizations did not seriously consider the risk of a pandemic. 

COVID-19 forced people to be restricted to their homes. And even when technological and telecommunications advances now deliver higher speeds and better-quality voice and audio, businesses require far more to continue running all aspects of their operations.

For instance, in every organization, the sales process is important to maintain cash flow, as well as to continue managing the workforce and internal activities such as finance and accounting, operations, and technology. There is an additional array of considerations that go into ensuring business continuity during a pandemic. The goal of this article, hence, is to share a few of these considerations and recommendations with you.

What should a business continuity plan include?

As stated earlier, the first consideration for business continuity in a pandemic scenario is the preservation and availability of the workforce. In line with the social distancing mandate issued by the government to minimize the spread of COVID-19, the safety and health of employees always comes first.  

Therefore, all company policies and procedures should be documented in such a way that employees can easily refer to them during a business interruption event. This is particularly important for middle-market companies, where a leaner workforce performs few functions deemed redundant.  Policies and procedures must be amply disseminated, along with cross training, to ensure that critical company activities indeed continue to work during a pandemic.

The business continuity plan should include a communications plan that should be shared with employees and clients. The communications plan should state whether the organization will continue operating during the event or pandemic, as well as the preferred methods of communication—such as landline, radio, television, and social media. The organization should also document procedures to ensure that business communications are answered, be they through mechanisms such as call forwarding or Voice over IP technology (VoIP), so that employees can continue serving customers.

The business continuity plan should also address employees whose tasks demand physical resources that are unavailable in a digital format, such as printed documents (invoices, payments, or checks). While some companies have transitioned to a paperless process— archiving such documents in a central repository where only authorized employees can access them using their computers—most companies still produce many such documents on a daily basis. This practice requires a significant amount of physical archiving space and limits employee access during a pandemic.

While governments and business organizations have granted periods for employees to come in to the workplace and retrieve physical resources, estimating which documents will be needed from one period to another can be quite difficult.

Another physical consideration relates to magnetic data backups. This process usually calls for a person to remove physical media and place them in an external vault. During the pandemic, many companies have had to improvise to address this challenge, as they did not consider it within their business continuity plan, perhaps believing that a pandemic was not a real or potential threat.

Some companies were already storing their data in the cloud, usually by leasing online data storage space. While this has proven to be a successful strategy, it is important to consider the legal and regulatory aspects that may be involved in online data storage. In some countries, laws limit or even prohibit transferring confidential data beyond borders. Therefore, companies considering online data storage are advised to know the physical location of their cloud storage facilities in order to ensure compliance with applicable laws and regulations.  Companies that choose this alternative can also face higher costs from their Internet service provider, due to increased demand on their broadband service. However, during a pandemic, when employees are unable or unavailable to rotate backup media and place them in a remote vault, online data storage guarantees that data access and safekeeping processes will continue, even if an event prevents the lack of access to or availability of the primary data center.

It is just as important to make sure that your telecommunications service provider has redundant networks, should they also have to deal with a business interruption event. To mitigate this risk, many companies choose to have two or more such providers. Nevertheless, companies should make it a point to request their telecommunications service provider’s contingency plans or third-party certifications. Should a major event occur, this would provide you with the guarantee and reliability of knowing that your telecommunications service provider will continue delivering at the level of service you need, for as long as needed.

As a source of primary income for companies, understanding customers’ needs during a disruptive event is essential. During the COVID-19 crisis, companies are dealing with new challenges and needs that require a clear understanding of their customers’ necessities, and the adaptation of service offerings, both to retain business and to ensure a steady source of income. Communication with clients is essential, to point out those needs and to gather frequent feedback on how well you are meeting those needs.

Similarly, other business aspects continue growing and evolving as opportunities arise to offer new products and services. To survive post COVID-19, it is critical that companies continue providing new products and services, and that they communicate it effectively to clients.

Finally, it is critical that employees continue performing their tasks to meet company goals. To this purpose, remote work tools are essential for business continuity. COVID-19 has made it evident. It is no longer good enough to make a phone call or a video conference. We must work collaboratively, as a team, and instantly.  We need to share documents and be able to work on them, collaboratively, in real-time. This sets the bar high in terms of goals and efficiency.

Collaboration tools such as Microsoft Teams, Google Meet, Zoom, GoToMeeting, and Slack, among others, have become a new reality, a requirement to ensure that we carry on with our tasks and support business continuity. These types of tools allow us to prepare, review and share documents and worksheets to meet business goals, all the while enhancing productivity. After the pandemic, such tools will become our alternate reality.

Business Continuity: The Anticipation Game

In summary, business continuity is an anticipation game in which one must consider every possible scenario and prepare for it, regardless of the odds. That being said, it is important to note that the approach to preparedness should be based on priorities.

Once an organization understands how it should prepare for the most likely events, it needs to move on to addressing those with mid-level probability. Previously, a pandemic would fall into this category.  Not anymore. After the current situation subsides, when daily operations resume, it will be imperative for each organization to prepare to quickly respond to the implications of this scenario.

Here are the most important items to consider in a business continuity plan:

1. Workforce – Ensure that they have access to the tools required to fulfill their tasks and receive the necessary training, even those who work with non-technological resources.
2. Remote storage – Ensure that tapes continue going to a remote vault or move to an online storage solution with cloud storage.
3. Continuity of providers – Ensure that providers have a business continuity plan or a third-party certification assuring that your organization can continue providing critical services dependent on them.
4. Redirect telecommunications – Ensure that client contacts are addressed, particularly customer service and inquiries from potential clients.
5. Collaboration tools – Ensure that the workforce can continue doing its job, including tasks that require feedback or interaction from several departments or areas.

 

Download Spanish Version 

 

 

 

This article was authored by Marco Ramos, Risk Consulting Manager at RSM Puerto Rico, in collaboration with RSM Latin America.

If you have risk assessment or business continuity questions, you may contact Marco Ramos at [email protected].